Event ID 4 — Time Provider Service Functions

Applies To: Windows Server 2008

If a computer has been designated as a time provider, it can send the time on to any computer requesting time synchronization at any point in this process.

The Windows Time service time synchronization process involves the following steps:

• Input providers request and receive time samples from configured Network Time Protocol (NTP) time sources.
• These time samples are then passed to the Windows Time Service Manager, which collects all the samples and passes them to the clock discipline subcomponent.
• The clock discipline subcomponent applies all NTP algorithms and selects the best time sample.
• The clock discipline subcomponent adjusts the time of the system clock to the most accurate time by either adjusting the clock rate or directly changing the time.

Event Details

Resolve

Address service startup errors

The Windows Time service failed to start. The error in Event Viewer should provide additional information. If you are not able to resolve this issue with the information in the event description:

• Restart the Windows Time service.
• If you have not enabled Windows Time service logging, enable it. Attempt to restart the Windows Time service after you enable logging.
• After you enable logging, review the Windows Time log file, and then unregister and register the Windows Time service.
• Verify Windows Time settings from the registry.

If these steps do not resolve the issue, restart the computer.

Perform the following procedures on the computer that is logging the event to be resolved.

To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.

Restart the Windows Time service

To restart the Windows Time service:

1. Click Start. In Start Search, type services.msc, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. The Services snap-in opens.
2. In the list of services, right-click Windows Time, and then click Restart. ( If the service is not running, click Start.)

Enable Windows Time service logging

To enable Windows Time service logging:

1. Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
2. Create a folder to receive the Windows Time service log file. At the command prompt, type md c:\W32Time, and then press ENTER. This command creates a directory named W32Time on the C: drive.
3. To enable Windows Time service debug logging, at the command prompt, type w32tm /debug /enable /file:c:\W32Time\w32time.log /size:10000000 /entries:0-116, and then press ENTER.

Review the Windows Time log file

To review the Windows Time log file:

1. Open the w32time.log file in Notepad. At the command prompt, type start notepad c:\w32time\w32time.log, and then press ENTER.
2. Scroll to the end of the log to see if you can identify any errors that indicate that Windows Time service values from the registry are null. You can reset the Windows Time service values in the registry by unregistering and then registering the service.

Unregister and register the W32time service

To unregister and register the Windows Time service:

1. To stop the Windows Time service, at the command prompt, running as an administrator, type net stop w32time, and then press ENTER.
2. To unregister the Windows Time service dynamic-link library (DLL), at the command prompt, type w32tm /unregister, and then press ENTER.
3. To register the Windows Time service DLL, at the command prompt, type w32time /register, and then press ENTER.
4. To start the Windows Time service, at the command prompt, type net start w32time, and then press ENTER.

To learn more about the Windows Time service and related tools, see Windows Time Service Tools and Settings (https://go.microsoft.com/fwlink/?LinkID=42984).

Verify Windows Time settings from the registry

If you or another administrator modified the default values or if you ran a program that modified them, you can perform the following procedure to check the configuration of those default values.

To verify Windows Time settings from the registry:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

1. Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
2. At the command prompt, type w32tm /dumpreg /subkey:config, and then press ENTER to verify that the values are configured as expected. If they are not, correct the values in the registry.

Post-troubleshooting cleanup

You can disable Windows Time debug logging by running the command W32tm /debug /disable. You can also remove the c:\w32time folder and w32time.log file when troubleshooting is complete.

To remove the folder and the log file:

1. Stop the Windows Time service. To stop the Windows Time service, at a command prompt, type net stop w32time, and then press ENTER.
2. To remove the c:\w32time folder, at the command prompt, type rd c:\w32time /s /q, and then press ENTER.
3. Start the Windows Time service again. To start the Windows Time service, type net start w32time, and then press ENTER.
4. Close the command prompt window.

To learn more about the Windows Time service and related tools, see Windows Time Service Tools and Settings (https://go.microsoft.com/fwlink/?LinkID=42984).

Verify

To verify that the Windows Time service is functioning correctly, check Event Viewer for entries that indicate that the service started successfully and that the system time is synchronizing.

Perform the following procedure on the computer that is logging the event to be resolved.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that the Windows Time service is functioning correctly:

1. Click Start. In Start Search, type services.msc, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. The Services snap-in opens.
2. In the list of services, confirm that the Windows Time service is running.

When the service starts successfully, the Service Control Manager reports that the Windows Time service has entered the running state (Event ID 7036). The W32Time source in Event Viewer reports receipt of time updates and clock synchronization (Event IDs 37 and 35, respectively).

For more information about the Windows Time service, see the Windows Time Service Technical Reference (https://go.microsoft.com/fwlink/?LinkID=25393).

Related Management Information

Time Provider Service Functions

Active Directory